[{"data":1,"prerenderedAt":1881},["ShallowReactive",2],{"/de-de/blog/2025-owasp-top-10-whats-changed-and-why-it-matters":3,"navigation-de-de":1098,"banner-de-de":1530,"footer-de-de":1538,"blog-post-authors-de-de-Fernando Diaz":1779,"blog-related-posts-de-de-2025-owasp-top-10-whats-changed-and-why-it-matters":1794,"next-steps-de-de":1818,"blog-promotions-de-de":1828},{"id":4,"title":5,"authors":6,"body":8,"category":1079,"date":1080,"description":1081,"extension":1082,"externalUrl":1083,"faq":1083,"featured":1084,"heroImage":1085,"meta":1086,"navigation":1087,"path":1088,"seo":1089,"slug":1092,"stem":1093,"tags":1094,"template":1096,"updatedDate":1083,"__hash__":1097},"blogPosts/de-de/blog/2025-owasp-top-10-whats-changed-and-why-it-matters.md","OWASP Top 10 2025: Was sich geändert hat und warum es wichtig ist",[7],"Fernando Diaz",{"type":9,"value":10,"toc":1054},"minimark",[11,22,33,38,41,44,51,56,73,77,94,98,101,104,107,111,144,147,173,194,209,218,222,226,231,234,238,255,259,282,286,289,292,295,312,315,338,341,344,347,350,367,370,386,390,393,396,399,416,419,435,439,442,445,448,468,471,487,491,494,497,500,517,520,543,547,550,553,556,573,576,597,601,604,607,610,627,630,653,657,660,663,666,683,686,709,712,715,718,721,741,744,767,771,774,779,836,842,849,853,901,906,911,915,951,957,962,966,991,997,1002,1006,1038],[12,13,14,15,21],"p",{},"Die OWASP Foundation hat die ",[16,17,20],"a",{"href":18,"rel":19},"https://owasp.org/Top10/2025/0x00_2025-Introduction/",[],"achte Edition ihrer einflussreichen „Top 10 Security Risks\"-Liste für 2025"," veröffentlicht und führt bedeutende Änderungen ein, die die sich entwickelnde Landschaft der Applikationssicherheit widerspiegeln. Basierend auf der Analyse von mehr als 175.000 Common Vulnerabilities and Exposures (CVEs) und Feedback von Security-Praktikern weltweit adressiert dieses Update moderne Angriffsvektoren. Im Folgenden wird erläutert, was sich geändert hat, warum diese Änderungen wichtig sind und wie Systeme geschützt werden können.",[23,24,25],"blockquote",{},[12,26,27,28],{},"💡 Am 10. Februar hat GitLab auf der Transcend gezeigt, wie Agentic AI Software Delivery transformiert – mit Kunden-Einblicken und Impulsen zur Modernisierung. ",[16,29,32],{"href":30,"rel":31},"https://about.gitlab.com/de-de/events/transcend/virtual/",[],"Mehr erfahren.",[34,35,37],"h2",{"id":36},"was-ist-neu-in-2025","Was ist neu in 2025?",[12,39,40],{},"Die Verschiebung von 2021 (als die Liste zuletzt erschien) zu 2025 stellt mehr als kleine Anpassungen dar – es ist ein fundamentaler Wandel in der Applikationssicherheit. Zwei vollständig neue Kategorien wurden in die Liste aufgenommen und eine Kategorie in eine andere konsolidiert, was aufkommende Risiken hervorhebt, die traditionelle Tests oft übersehen.",[12,42,43],{},"Diese Ergänzungen und Verschiebungen sind in der folgenden Grafik zu sehen:",[12,45,46],{},[47,48],"img",{"alt":49,"src":50},"OWASP Top 10 - Changes from 2021 to 2025","https://res.cloudinary.com/about-gitlab-com/image/upload/v1767639428/tbekzibeqylorwqrkdau.png",[52,53,55],"h3",{"id":54},"zwei-neue-kategorien","Zwei neue Kategorien",[57,58,59,67],"ul",{},[60,61,62,66],"li",{},[63,64,65],"strong",{},"A03: Software Supply Chain Failures",": Erweitert die 2021-Kategorie „Vulnerable and Outdated Components\" um die gesamte Software-Supply-Chain, einschließlich Dependencies, Build-Systeme und Distributions-Infrastruktur. Trotz der geringsten Vorkommen in Testdaten hat diese Kategorie die höchsten durchschnittlichen Exploit- und Impact-Scores aus CVEs.",[60,68,69,72],{},[63,70,71],{},"A10: Mishandling of Exceptional Conditions",": Fokussiert auf fehlerhafte Error-Behandlung, logische Fehler und Failing-Open-Szenarien. Diese Kategorie adressiert, wie Systeme auf abnormale Bedingungen reagieren.",[52,74,76],{"id":75},"wesentliche-ranking-änderungen","Wesentliche Ranking-Änderungen",[57,78,79,82,85,88,91],{},[60,80,81],{},"Security Misconfiguration stieg von #5 (2021) auf #2 (2025) und betrifft nun 3 % der getesteten Applikationen.",[60,83,84],{},"Server-Side Request Forgery (SSRF) wurde in A01: Broken Access Control konsolidiert.",[60,86,87],{},"Cryptographic Failures fielen von #2 auf #4.",[60,89,90],{},"Injection fiel von #3 auf #5.",[60,92,93],{},"Insecure Design verschob sich von #4 auf #6.",[34,95,97],{"id":96},"warum-diese-änderungen-vorgenommen-wurden","Warum diese Änderungen vorgenommen wurden",[12,99,100],{},"Die OWASP-Methodik kombiniert datengetriebene Analyse mit Community-Einblicken. Die 2025-Edition analysierte 589 Common Weakness Enumerations (CWEs) – eine substanzielle Steigerung gegenüber den etwa 400 CWEs in 2021. Diese Erweiterung reflektiert die wachsende Komplexität moderner Software-Systeme und die Notwendigkeit, aufkommende Bedrohungen zu erfassen.",[12,102,103],{},"Die Community-Survey-Komponente adressiert eine fundamentale Einschränkung: Testdaten schauen im Wesentlichen in die Vergangenheit. Bis Security-Forschende Testmethoden entwickeln und in automatisierte Tools integrieren, können Jahre vergangen sein. Die beiden community-voted Kategorien stellen sicher, dass aufkommende Risiken, die von Praktikern an vorderster Front identifiziert wurden, eingeschlossen werden – selbst wenn sie noch nicht in automatisierten Testdaten verbreitet sind.",[12,105,106],{},"Der Anstieg von Security Misconfiguration hebt einen Branchentrend zur konfigurationsbasierten Sicherheit hervor, während Software Supply Chain Failures den Anstieg ausgefeilter Angriffe auf kompromittierte Packages widerspiegelt.",[34,108,110],{"id":109},"gitlab-ultimate-für-vulnerability-detection-und-management-nutzen","GitLab Ultimate für Vulnerability-Detection und -Management nutzen",[12,112,113,114,119,120,125,126,131,132,137,138,143],{},"GitLab Ultimate bietet umfassendes ",[16,115,118],{"href":116,"rel":117},"https://docs.gitlab.com/user/application_security/detect/",[],"Security-Scanning"," zur Erkennung von Risiken über alle OWASP-Top-10-2025-Kategorien hinweg. Die End-to-End-Plattform analysiert Quellcode, Dependencies und Infrastrukturdefinitionen von Projekten. ",[16,121,124],{"href":122,"rel":123},"https://docs.gitlab.com/user/application_security/sast/gitlab_advanced_sast/",[],"Advanced Static Application Security Testing (SAST)"," erkennt Injection-Schwachstellen, Cryptographic Failures und unsichere Design-Patterns im Quellcode. ",[16,127,130],{"href":128,"rel":129},"https://docs.gitlab.com/user/application_security/iac_scanning/",[],"Infrastructure as Code (IaC) Scanning"," findet Security-Fehlkonfigurationen in Deployment-Definitionen. ",[16,133,136],{"href":134,"rel":135},"https://docs.gitlab.com/user/application_security/secret_detection/",[],"Secret Detection"," verhindert das Leaken von Credentials, und ",[16,139,142],{"href":140,"rel":141},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency Scanning"," deckt Bibliotheken mit bekannten Schwachstellen in der Software-Supply-Chain auf – und adressiert damit direkt die neue A03-Kategorie für Software Supply Chain Failures.",[12,145,146],{},"Darüber hinaus:",[57,148,149,157,165],{},[60,150,151,156],{},[16,152,155],{"href":153,"rel":154},"https://docs.gitlab.com/user/application_security/dast/",[],"Dynamic Application Security Testing (DAST)"," testet die deployten Applikationen auf Broken Access Control, Authentication Failures und Injection-Schwachstellen durch Simulation von Angriffsvektoren.",[60,158,159,164],{},[16,160,163],{"href":161,"rel":162},"https://docs.gitlab.com/user/application_security/api_security/",[],"API Security Testing"," prüft API-Endpoints auf Input-Validation-Schwächen und Authentication-Bypasses.",[60,166,167,172],{},[16,168,171],{"href":169,"rel":170},"https://docs.gitlab.com/user/application_security/api_fuzzing/",[],"Web API Fuzz Testing"," deckt auf, wie Applikationen mit Ausnahmebedingungen umgehen, indem unerwartete Inputs generiert werden – und adressiert damit direkt die neue A10-Kategorie für Mishandling of Exceptional Conditions.",[12,174,175,176,181,182,187,188,193],{},"Security-Scanning integriert sich nahtlos in die ",[16,177,180],{"href":178,"rel":179},"https://about.gitlab.com/de-de/topics/ci-cd/",[],"CI/CD-Pipeline"," und läuft beim Push von einem Feature-Branch, sodass Entwicklungsteams Schwachstellen beheben können, bevor sie Production erreichen. Security-Ergebnisse werden im ",[16,183,186],{"href":184,"rel":185},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"Vulnerability Report"," konsolidiert, wo Security-Teams triagieren, analysieren und die Behebung nachverfolgen können. GitLab ermöglicht außerdem den Einsatz von KI-Agents wie dem ",[16,189,192],{"href":190,"rel":191},"https://about.gitlab.com/de-de/blog/vulnerability-triage-made-simple-with-gitlab-security-analyst-agent/",[],"Security Analyst Agent"," in der GitLab Duo Agent Platform, um die kritischsten Schwachstellen und die erforderlichen Maßnahmen schnell zu identifizieren.",[12,195,196,197,202,203,208],{},"Zusätzliche Kontrollen lassen sich über ",[16,198,201],{"href":199,"rel":200},"https://docs.gitlab.com/user/application_security/policies/merge_request_approval_policies/",[],"Merge-Request-Approval-Policies"," und ",[16,204,207],{"href":205,"rel":206},"https://docs.gitlab.com/user/application_security/policies/pipeline_execution_policies/",[],"Pipeline-Execution-Policies"," durchsetzen, um sicherzustellen, dass Security-Scanning konsistent in der gesamten Organisation ausgeführt wird. Customer-Success- und Professional-Services-Teams bei GitLab unterstützen dabei, den Wert einer GitLab-Investition zeitnah zu realisieren.",[12,210,211,212,217],{},"Sichere Software mit Security-Testing in derselben Plattform bereitstellen, die Entwicklungsteams bereits nutzen. Mehr dazu auf der ",[16,213,216],{"href":214,"rel":215},"https://about.gitlab.com/de-de/solutions/application-security-testing/",[],"Application Security Testing Solutions-Seite",".",[34,219,221],{"id":220},"die-owasp-top-10-2025-vollständige-aufschlüsselung","Die OWASP Top 10 2025: Vollständige Aufschlüsselung",[52,223,225],{"id":224},"a01-broken-access-control","A01: Broken Access Control",[227,228,230],"h5",{"id":229},"was-es-ist","Was es ist",[12,232,233],{},"Fehler bei der Durchsetzung von Richtlinien, die verhindern, dass Nutzende außerhalb ihrer vorgesehenen Berechtigungen handeln – was zu unbefugtem Zugriff führt.",[227,235,237],{"id":236},"auswirkungen-auf-das-system","Auswirkungen auf das System",[57,239,240,243,246,249,252],{},[60,241,242],{},"Unbefugte Informationsoffenlegung",[60,244,245],{},"Vollständige Datenzerstörung oder -modifikation",[60,247,248],{},"Privilege Escalation (Nutzende erlangen Admin-Rechte)",[60,250,251],{},"Einsehen oder Bearbeiten der Accounts anderer Nutzender",[60,253,254],{},"API-Zugriff von nicht autorisierten oder nicht vertrauenswürdigen Quellen",[227,256,258],{"id":257},"relevante-cwes","Relevante CWEs",[57,260,261,268,275],{},[60,262,263],{},[16,264,267],{"href":265,"rel":266},"https://cwe.mitre.org/data/definitions/22.html",[],"CWE-22: Path Traversal",[60,269,270],{},[16,271,274],{"href":272,"rel":273},"https://cwe.mitre.org/data/definitions/200.html",[],"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",[60,276,277],{},[16,278,281],{"href":279,"rel":280},"https://cwe.mitre.org/data/definitions/352.html",[],"CWE-352: Cross-Site Request Forgery (CSRF)",[52,283,285],{"id":284},"a02-security-misconfiguration","A02: Security Misconfiguration",[227,287,230],{"id":288},"was-es-ist-1",[12,290,291],{},"Systeme, Applikationen oder Cloud-Services, die aus Security-Perspektive fehlerhaft konfiguriert sind.",[227,293,237],{"id":294},"auswirkungen-auf-das-system-1",[57,296,297,300,303,306,309],{},[60,298,299],{},"Offenlegung sensibler Informationen durch Fehlermeldungen",[60,301,302],{},"Unbefugter Zugriff über Default-Accounts",[60,304,305],{},"Unnötige Services oder Features aktiviert",[60,307,308],{},"Veraltete Security-Patches",[60,310,311],{},"Server sendet keine Security-Header oder -Direktiven",[227,313,258],{"id":314},"relevante-cwes-1",[57,316,317,324,331],{},[60,318,319],{},[16,320,323],{"href":321,"rel":322},"https://cwe.mitre.org/data/definitions/16.html",[],"CWE-16: Configuration",[60,325,326],{},[16,327,330],{"href":328,"rel":329},"https://cwe.mitre.org/data/definitions/521.html",[],"CWE-521: Weak Password Requirements",[60,332,333],{},[16,334,337],{"href":335,"rel":336},"https://cwe.mitre.org/data/definitions/798.html",[],"CWE-798: Use of Hard-coded Credentials",[52,339,65],{"id":340},"a03-software-supply-chain-failures",[227,342,230],{"id":343},"was-es-ist-2",[12,345,346],{},"Ausfälle oder Kompromittierungen beim Erstellen, Verteilen oder Aktualisieren von Software – durch Schwachstellen oder böswillige Änderungen in Dependencies, Tools oder Build-Prozessen.",[227,348,237],{"id":349},"auswirkungen-auf-das-system-2",[57,351,352,355,358,361,364],{},[60,353,354],{},"Kompromittierte Packages, die Backdoors einschleusen",[60,356,357],{},"Schädlicher Code, der während Build-Prozessen injiziert wird",[60,359,360],{},"Verwundbare Dependencies, die sich durch die Applikation kaskadieren",[60,362,363],{},"Nutzung von Komponenten aus nicht vertrauenswürdigen Quellen in Production",[60,365,366],{},"Änderungen in der Supply Chain werden nicht nachverfolgt",[227,368,258],{"id":369},"relevante-cwes-2",[57,371,372,379],{},[60,373,374],{},[16,375,378],{"href":376,"rel":377},"https://cwe.mitre.org/data/definitions/1395.html",[],"CWE-1395: Dependency on Vulnerable Third-Party Component",[60,380,381],{},[16,382,385],{"href":383,"rel":384},"https://cwe.mitre.org/data/definitions/1104.html",[],"CWE-1104: Use of Unmaintained Third Party Components",[52,387,389],{"id":388},"a04-cryptographic-failures","A04: Cryptographic Failures",[227,391,230],{"id":392},"was-es-ist-3",[12,394,395],{},"Fehler im Zusammenhang mit fehlender Kryptographie, unzureichend starker Kryptographie, Leaking von kryptographischen Schlüsseln und verwandten Fehlern.",[227,397,237],{"id":398},"auswirkungen-auf-das-system-3",[57,400,401,404,407,410,413],{},[60,402,403],{},"Offenlegung sensibler Daten (Passwörter, Kreditkarten, Gesundheitsdaten)",[60,405,406],{},"Man-in-the-Middle-Angriffe",[60,408,409],{},"Datenpanne durch schwache Verschlüsselung",[60,411,412],{},"Schlüssel-Kompromittierung mit systemweiter Exposition",[60,414,415],{},"Verstoß gegen regulatorische Compliance-Anforderungen (DSGVO, PCI DSS)",[227,417,258],{"id":418},"relevante-cwes-3",[57,420,421,428],{},[60,422,423],{},[16,424,427],{"href":425,"rel":426},"https://cwe.mitre.org/data/definitions/327.html",[],"CWE-327: Use of a Broken or Risky Cryptographic Algorithm",[60,429,430],{},[16,431,434],{"href":432,"rel":433},"https://cwe.mitre.org/data/definitions/330.html",[],"CWE-330: Use of Insufficiently Random Values",[52,436,438],{"id":437},"a05-injection","A05: Injection",[227,440,230],{"id":441},"was-es-ist-4",[12,443,444],{},"Systemschwachstellen, die es Angreifenden ermöglichen, Schadcode oder -befehle (SQL, NoSQL, OS-Befehle, LDAP usw.) in Programme einzuschleusen.",[227,446,237],{"id":447},"auswirkungen-auf-das-system-4",[57,449,450,453,456,459,462,465],{},[60,451,452],{},"Datenverlust oder -korruption durch SQL-Injection",[60,454,455],{},"Vollständige Datenbank-Kompromittierung",[60,457,458],{},"Server-Übernahme durch Command-Injection",[60,460,461],{},"Cross-Site-Scripting-(XSS)-Angriffe",[60,463,464],{},"Informationsoffenlegung",[60,466,467],{},"Denial of Service",[227,469,258],{"id":470},"relevante-cwes-4",[57,472,473,480],{},[60,474,475],{},[16,476,479],{"href":477,"rel":478},"https://cwe.mitre.org/data/definitions/89.html",[],"CWE-89: SQL Injection",[60,481,482],{},[16,483,486],{"href":484,"rel":485},"https://cwe.mitre.org/data/definitions/78.html",[],"CWE-78: OS Command Injection",[52,488,490],{"id":489},"a06-insecure-design","A06: Insecure Design",[227,492,230],{"id":493},"was-es-ist-5",[12,495,496],{},"Schwächen im Design, die verschiedene Fehler repräsentieren – ausgedrückt als fehlendes oder unwirksames Kontrolldesign. Architekturelle Mängel statt Implementierungs-Bugs.",[227,498,237],{"id":499},"auswirkungen-auf-das-system-5",[57,501,502,505,508,511,514],{},[60,503,504],{},"Schwache Passwort-Reset-Flows",[60,506,507],{},"Fehlende Autorisierungsschritte",[60,509,510],{},"Fehlerhafte Business-Logik, die Umgehungen ermöglicht",[60,512,513],{},"Unzureichendes Threat Modeling, das blinde Flecken erzeugt",[60,515,516],{},"Design-Patterns, die unter Angriffsszenarien versagen",[227,518,258],{"id":519},"relevante-cwes-5",[57,521,522,529,536],{},[60,523,524],{},[16,525,528],{"href":526,"rel":527},"https://cwe.mitre.org/data/definitions/209.html",[],"CWE-209: Generation of Error Messages Containing Sensitive Information",[60,530,531],{},[16,532,535],{"href":533,"rel":534},"https://cwe.mitre.org/data/definitions/522.html",[],"CWE-522: Insufficiently Protected Credentials",[60,537,538],{},[16,539,542],{"href":540,"rel":541},"https://cwe.mitre.org/data/definitions/656.html",[],"CWE-656: Reliance on Security Through Obscurity",[52,544,546],{"id":545},"a07-authentication-failures","A07: Authentication Failures",[227,548,230],{"id":549},"was-es-ist-6",[12,551,552],{},"Schwachstellen, die es Angreifenden ermöglichen, Systeme dazu zu bringen, ungültige oder fehlerhafte Identitäten als legitim zu erkennen.",[227,554,237],{"id":555},"auswirkungen-auf-das-system-6",[57,557,558,561,564,567,570],{},[60,559,560],{},"Account-Übernahme und Credential Stuffing",[60,562,563],{},"Session Hijacking",[60,565,566],{},"Erfolgreiche Brute-Force-Angriffe",[60,568,569],{},"Ausnutzung schwacher Passwort-Recovery-Mechanismen",[60,571,572],{},"Multi-Faktor-Authentifizierungs-Bypass",[227,574,258],{"id":575},"relevante-cwes-6",[57,577,578,585,592],{},[60,579,580],{},[16,581,584],{"href":582,"rel":583},"https://cwe.mitre.org/data/definitions/287.html",[],"CWE-287: Improper Authentication",[60,586,587],{},[16,588,591],{"href":589,"rel":590},"https://cwe.mitre.org/data/definitions/306.html",[],"CWE-306: Missing Authentication for Critical Function",[60,593,594],{},[16,595,330],{"href":328,"rel":596},[],[52,598,600],{"id":599},"a08-software-or-data-integrity-failures","A08: Software or Data Integrity Failures",[227,602,230],{"id":603},"was-es-ist-7",[12,605,606],{},"Code und Infrastruktur, die nicht verhindern, dass ungültiger oder nicht vertrauenswürdiger Code/Daten als vertrauenswürdig und valide behandelt werden.",[227,608,237],{"id":609},"auswirkungen-auf-das-system-7",[57,611,612,615,618,621,624],{},[60,613,614],{},"Unsignierte Updates, die Schadcode-Injection ermöglichen",[60,616,617],{},"Insecure Deserialization, die zu Remote Code Execution führt",[60,619,620],{},"CI/CD-Pipeline-Kompromittierung",[60,622,623],{},"Ausnutzung von Auto-Update-Mechanismen",[60,625,626],{},"Manipulierte Software-Artefakte",[227,628,258],{"id":629},"relevante-cwes-7",[57,631,632,639,646],{},[60,633,634],{},[16,635,638],{"href":636,"rel":637},"https://cwe.mitre.org/data/definitions/345.html",[],"CWE-345: Insufficient Verification of Data Authenticity",[60,640,641],{},[16,642,645],{"href":643,"rel":644},"https://cwe.mitre.org/data/definitions/346.html",[],"CWE-346: Origin Validation Error",[60,647,648],{},[16,649,652],{"href":650,"rel":651},"https://cwe.mitre.org/data/definitions/347.html",[],"CWE-347: Improper Verification of Cryptographic Signature",[52,654,656],{"id":655},"a09-security-logging-alerting-failures","A09: Security Logging & Alerting Failures",[227,658,230],{"id":659},"was-es-ist-8",[12,661,662],{},"Unzureichendes Logging und Monitoring mit inadäquatem Alerting, was schnelle Reaktion erschwert.",[227,664,237],{"id":665},"auswirkungen-auf-das-system-8",[57,667,668,671,674,677,680],{},[60,669,670],{},"Angriffe bleiben über längere Zeiträume unentdeckt",[60,672,673],{},"Breach-Investigation wird unmöglich",[60,675,676],{},"Compliance-Verstöße durch fehlende Audit-Trails",[60,678,679],{},"Verzögerte Incident-Response",[60,681,682],{},"Unfähigkeit, das Ausmaß einer Kompromittierung zu bestimmen",[227,684,258],{"id":685},"relevante-cwes-8",[57,687,688,695,702],{},[60,689,690],{},[16,691,694],{"href":692,"rel":693},"https://cwe.mitre.org/data/definitions/117.html",[],"CWE-117: Improper Output Neutralization for Logs",[60,696,697],{},[16,698,701],{"href":699,"rel":700},"https://cwe.mitre.org/data/definitions/532.html",[],"CWE-532: Insertion of Sensitive Information into Log File",[60,703,704],{},[16,705,708],{"href":706,"rel":707},"https://cwe.mitre.org/data/definitions/778.html",[],"CWE-778: Insufficient Logging",[52,710,71],{"id":711},"a10-mishandling-of-exceptional-conditions",[227,713,230],{"id":714},"was-es-ist-9",[12,716,717],{},"Programme, die ungewöhnliche und unvorhersehbare Situationen nicht verhindern, erkennen und darauf reagieren – was zu Abstürzen, unerwartetem Verhalten oder Schwachstellen führt.",[227,719,237],{"id":720},"auswirkungen-auf-das-system-9",[57,722,723,726,729,732,735,738],{},[60,724,725],{},"Informationsoffenlegung durch zu detaillierte Fehlermeldungen",[60,727,728],{},"Denial of Service durch unbehandelte Exceptions",[60,730,731],{},"Zustandskorruption durch fehlerhafte Error-Behandlung",[60,733,734],{},"Ausnutzung von Race Conditions",[60,736,737],{},"Systeme, die bei Fehlern offen statt geschlossen schalten",[60,739,740],{},"Applikationsabstürze, die sensible Daten exponieren",[227,742,258],{"id":743},"relevante-cwes-9",[57,745,746,753,760],{},[60,747,748],{},[16,749,752],{"href":750,"rel":751},"https://cwe.mitre.org/data/definitions/248.html",[],"CWE-248: Uncaught Exception",[60,754,755],{},[16,756,759],{"href":757,"rel":758},"https://cwe.mitre.org/data/definitions/390.html",[],"CWE-390: Detection of Error Condition Without Action",[60,761,762],{},[16,763,766],{"href":764,"rel":765},"https://cwe.mitre.org/data/definitions/391.html",[],"CWE-391: Unchecked Error Condition",[34,768,770],{"id":769},"best-practices-für-prävention-und-remediation","Best Practices für Prävention und Remediation",[12,772,773],{},"GitLab bietet Tools, die nicht nur das schnelle Finden und Beheben von Schwachstellen innerhalb der OWASP Top 10 ermöglichen, sondern auch deren Eintritt in das Production-System verhindern. Durch Befolgen dieser Best Practices lässt sich die Security-Posture verbessern und aufrechterhalten:",[775,776,778],"h4",{"id":777},"automatisiertes-security-scanning-für-alle-repositories","Automatisiertes Security-Scanning für alle Repositories",[57,780,781,789,795,802,808,816,823,830],{},[60,782,783,788],{},[16,784,787],{"href":785,"rel":786},"https://docs.gitlab.com/user/application_security/sast/",[],"SAST-Scanning"," durchführen, um unsichere Design-Patterns wie Klartext-Passwortspeicherung, inadäquates Error-Handling und fehlende Verschlüsselung während Code-Reviews zu erkennen – Design-Fehler werden früh im Entwicklungszyklus aufgefangen.",[60,790,791,794],{},[16,792,136],{"href":134,"rel":793},[]," durchführen, um Credentials in Konfigurationsdateien, Umgebungsvariablen und Code zu identifizieren – dies verhindert Klartext-Passwortspeicherung und stellt sicher, dass Secrets ordnungsgemäß über GitLab-CI/CD-Variablen mit Masking und Verschlüsselung verwaltet werden.",[60,796,797,801],{},[16,798,800],{"href":153,"rel":799},[],"DAST-Scanning"," durchführen, um Broken-Access-Control-Schwachstellen zu erkennen.",[60,803,804,807],{},[16,805,142],{"href":140,"rel":806},[]," durchführen, um Projekt-Dependencies gegen Schwachstellen-Datenbanken zu scannen und bekannte CVEs in direkten und transitiven Dependencies über mehrere Package-Manager (npm, pip, Maven usw.) zu identifizieren.",[60,809,810,815],{},[16,811,814],{"href":812,"rel":813},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"Container Scanning"," durchführen, um Docker-Images auf verwundbare Base-Layer und Packages zu analysieren und die Container-Supply-Chain-Sicherheit vor dem Deployment sicherzustellen.",[60,817,818,822],{},[16,819,821],{"href":128,"rel":820},[],"IaC-Scanning"," durchführen, um Infrastruktur-Definitionsdateien auf bekannte Schwachstellen zu prüfen.",[60,824,825,829],{},[16,826,828],{"href":161,"rel":827},[],"API-Security-Tools"," nutzen, um Web-APIs vor unbefugtem Zugriff, Missbrauch und Angriffen zu schützen.",[60,831,832,835],{},[16,833,171],{"href":169,"rel":834},[]," durchführen, um Bugs und potenzielle Schwachstellen zu entdecken, die andere QA-Prozesse übersehen könnten.",[12,837,838],{},[47,839],{"alt":840,"src":841},"Security Results in MR","https://res.cloudinary.com/about-gitlab-com/image/upload/v1767639431/zs6xh8hz6mud3vuig3dy.png",[843,844,845],"center",{},[846,847,848],"i",{},"Erkannte Schwachstellen im MR mit Diff von Feature-Branch zu Main-Branch anzeigen.",[775,850,852],{"id":851},"die-security-posture-verstehen","Die Security-Posture verstehen",[57,854,855,864,871,885,893],{},[60,856,857,858,863],{},"Eine ",[16,859,862],{"href":860,"rel":861},"https://docs.gitlab.com/user/application_security/dependency_list/",[],"Software Bill of Materials (SBOM)"," generieren für vollständige Dependency-Transparenz und Compliance-Anforderungen.",[60,865,866,867,870],{},"Den ",[16,868,186],{"href":184,"rel":869},[]," nutzen, um Schwachstellen über eine konsolidierte Ansicht der im Codebase gefundenen Security-Vulnerabilities zu triagieren.",[60,872,873,874,202,879,884],{},"Mit ",[16,875,878],{"href":876,"rel":877},"https://docs.gitlab.com/user/application_security/vulnerabilities/",[],"detaillierter Remediation-Anleitung",[16,880,883],{"href":881,"rel":882},"https://docs.gitlab.com/user/application_security/vulnerabilities/risk_assessment_data/",[],"Risk-Assessment-Daten"," schnell auf Schwachstellen reagieren.",[60,886,887,892],{},[16,888,891],{"href":889,"rel":890},"https://docs.gitlab.com/user/application_security/security_inventory/",[],"Security Inventory"," nutzen, um zu visualisieren, welche Assets geschützt werden müssen und welche Maßnahmen zur Verbesserung der Sicherheit erforderlich sind.",[60,894,895,900],{},[16,896,899],{"href":897,"rel":898},"https://docs.gitlab.com/user/compliance/compliance_center/",[],"Compliance Center"," nutzen, um Compliance-Standards-Adherence-Reporting, Violations-Reporting und Compliance-Frameworks zu verwalten.",[12,902,903],{},[47,904],{"alt":891,"src":905},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1767639429/e9vnakc8yiyjbjm8aj7s.png",[843,907,908],{},[846,909,910],{},"Security Inventory nutzen, um aktivierte Security-Scanner und Schwachstellen einzusehen.",[775,912,914],{"id":913},"prävention-einrichten-und-dokumentation-pflegen","Prävention einrichten und Dokumentation pflegen",[57,916,917,925,933,942,945,948],{},[60,918,919,924],{},[16,920,923],{"href":921,"rel":922},"https://docs.gitlab.com/user/application_security/policies/",[],"Security Policies"," konfigurieren, um Merges oder Deployments zu blockieren, wenn hochgradig kritische Schwachstellen in Dependencies erkannt werden – Security-Standards werden automatisch durchgesetzt.",[60,926,927,932],{},[16,928,931],{"href":929,"rel":930},"https://docs.gitlab.com/user/compliance/compliance_frameworks/",[],"Compliance Frameworks"," nutzen, um organisationsweite Security-Standards durch automatisierte Policy-Checks durchzusetzen, die Verschlüsselungsanforderungen, Credential-Management-Praktiken und sichere Workflow-Implementierungen verifizieren.",[60,934,935,936,941],{},"GitLab Wiki und Repository-Dokumentation nutzen, um Security-Design-Prinzipien, genehmigte Patterns und Architectural Decision Records zu pflegen, die Entwicklungsteams zu ",[16,937,940],{"href":938,"rel":939},"https://about.gitlab.com/de-de/blog/last-year-we-signed-the-secure-by-design-pledge-heres-our-progress/",[],"Secure-by-Design-Implementierungen"," anleiten.",[60,943,944],{},"Merge-Request-Approval-Rules implementieren, die ein Security-Architect-Review für Features erfordern, die Authentication, Authorization, Verschlüsselung oder sensible Datenverarbeitung betreffen – so wird Security-Validierung auf Design-Ebene sichergestellt.",[60,946,947],{},"Tests erstellen, um Input-Validation und Allowlist-Ansätze für Dateipfade zu verifizieren.",[60,949,950],{},"GitLab Issues und Epics nutzen, um Security-Anforderungen und Threat Models in der Design-Phase zu dokumentieren – dies schafft eine nachvollziehbare Aufzeichnung von Security-Entscheidungen und stellt sicher, dass Security-Überlegungen vor Implementierungsbeginn adressiert werden.",[12,952,953],{},[47,954],{"alt":955,"src":956},"Security Policy Dashboard","https://res.cloudinary.com/about-gitlab-com/image/upload/v1767639429/q4eelq3rqt0oonzhwoyb.png",[843,958,959],{},[846,960,961],{},"Security Policies auf Instanz-, Gruppen- oder Projektebene anzeigen und festlegen.",[775,963,965],{"id":964},"ki-nutzen","KI nutzen",[57,967,968,976,983],{},[60,969,970,975],{},[16,971,974],{"href":972,"rel":973},"https://docs.gitlab.com/user/project/repository/code_suggestions/",[],"Code Suggestions"," für proaktive Guidance während der Entwicklung nutzen – mit Vorschlägen für sichere Design-Patterns wie korrektes Password-Hashing (bcrypt, Argon2), verschlüsselte Speichermechanismen und angemessenes Error-Handling, das keine sensiblen Informationen preisgibt.",[60,977,978,982],{},[16,979,192],{"href":980,"rel":981},"https://docs.gitlab.com/user/duo_agent_platform/agents/foundational_agents/security_analyst_agent/",[]," nutzen, um erkannte Insecure-Design-Schwachstellen im Kontext zu bewerten – mit Erklärung der architekturellen Implikationen, Risikobewertung basierend auf dem Threat Model der Applikation und Remediation-Strategien, die grundlegende Design-Fehler statt nur Symptome adressieren.",[60,984,985,990],{},[16,986,989],{"href":987,"rel":988},"https://docs.gitlab.com/user/project/merge_requests/duo_in_merge_requests/#have-gitlab-duo-review-your-code",[],"Code mit KI reviewen lassen",", um konsistente Code-Review-Standards im Projekt sicherzustellen.",[12,992,993],{},[47,994],{"alt":995,"src":996},"GitLab Security Analyst Agent","https://res.cloudinary.com/about-gitlab-com/image/upload/v1767639430/kqvgagepwleabt5zdkco.png",[843,998,999],{},[846,1000,1001],{},"Security Analyst Agent nutzen, um Security-Schwachstellen schnell zu triagieren und zu bewerten.",[34,1003,1005],{"id":1004},"kernaussagen-für-entwicklungsteams","Kernaussagen für Entwicklungsteams",[57,1007,1008,1014,1020,1026,1032],{},[60,1009,1010,1013],{},[63,1011,1012],{},"Supply-Chain-Sicherheit ist entscheidend",": Mit der Aufnahme von A03 und den hohen Impact-Scores ist die Absicherung der Software-Supply-Chain keine Option mehr. SBOM-Tracking, Dependency-Scanning und Integritätsprüfung sollten durchgängig in der Pipeline implementiert werden.",[60,1015,1016,1019],{},[63,1017,1018],{},"Konfiguration ist wichtiger denn je",": Der Aufstieg auf #2 zeigt, dass konfigurationsbasierte Sicherheit nun ein primärer Angriffsvektor ist. Konfigurationsverifizierung automatisieren und IaC mit integrierter Security implementieren.",[60,1021,1022,1025],{},[63,1023,1024],{},"Traditionelle Bedrohungen bestehen fort",": Obwohl Injection und Cryptographic Failures im Ranking gefallen sind, bleiben sie kritisch. Die Priorisierung nicht reduzieren, nur weil sie in der Liste gefallen sind.",[60,1027,1028,1031],{},[63,1029,1030],{},"Error-Handling ist Security",": Die neue A10-Kategorie unterstreicht, dass der Umgang der Applikation mit Fehlern ein Security-Thema ist. Sicheres Error-Handling von Beginn an implementieren.",[60,1033,1034,1037],{},[63,1035,1036],{},"Testing muss sich weiterentwickeln",": Die erweiterte CWE-Abdeckung (589 vs. 400 in 2021) bedeutet, dass Testing-Strategien umfassend sein müssen. SAST, DAST, Quellcode-Analyse und manuelles Penetration-Testing für effektive Abdeckung kombinieren.",[23,1039,1040],{},[12,1041,1042,1043,1047,1048,1053],{},"Die ",[16,1044,1046],{"href":214,"rel":1045},[],"GitLab Security and Governance Solutions"," und die ",[16,1049,1052],{"href":1050,"rel":1051},"https://docs.gitlab.com/user/application_security/",[],"Security-Scanning-Dokumentation"," bieten weitere Informationen zur Stärkung der Security-Posture.",{"title":1055,"searchDepth":1056,"depth":1056,"links":1057},"",2,[1058,1063,1064,1065,1077,1078],{"id":36,"depth":1056,"text":37,"children":1059},[1060,1062],{"id":54,"depth":1061,"text":55},3,{"id":75,"depth":1061,"text":76},{"id":96,"depth":1056,"text":97},{"id":109,"depth":1056,"text":110},{"id":220,"depth":1056,"text":221,"children":1066},[1067,1068,1069,1070,1071,1072,1073,1074,1075,1076],{"id":224,"depth":1061,"text":225},{"id":284,"depth":1061,"text":285},{"id":340,"depth":1061,"text":65},{"id":388,"depth":1061,"text":389},{"id":437,"depth":1061,"text":438},{"id":489,"depth":1061,"text":490},{"id":545,"depth":1061,"text":546},{"id":599,"depth":1061,"text":600},{"id":655,"depth":1061,"text":656},{"id":711,"depth":1061,"text":71},{"id":769,"depth":1056,"text":770},{"id":1004,"depth":1056,"text":1005},"security","2026-02-17","Neue Supply-Chain- und Error-Handling-Risiken, Ranking-Verschiebungen und Remediation-Strategien für alle 10 Kategorien.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png",{},true,"/de-de/blog/2025-owasp-top-10-whats-changed-and-why-it-matters",{"title":1090,"description":1091},"OWASP Top 10 2025: Änderungen & Bedeutung","Supply-Chain-Failures & Error-Handling neu, Security Misconfiguration #2. Alle 10 OWASP-2025-Kategorien mit Remediation-Strategien und GitLab-Abdeckung.","2025-owasp-top-10-whats-changed-and-why-it-matters","de-de/blog/2025-owasp-top-10-whats-changed-and-why-it-matters",[1079,1095],"open source","BlogPost","On8wcvtSCJa8iLYt2W-w5ypQLBEeN0IRxpZGdJ9zajE",{"logo":1099,"freeTrial":1104,"sales":1109,"login":1114,"items":1119,"search":1448,"minimal":1482,"duo":1500,"switchNav":1509,"pricingDeployment":1520},{"config":1100},{"href":1101,"dataGaName":1102,"dataGaLocation":1103},"/de-de/","gitlab logo","header",{"text":1105,"config":1106},"Kostenlose Testversion anfordern",{"href":1107,"dataGaName":1108,"dataGaLocation":1103},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/de-de&glm_content=default-saas-trial/","free trial",{"text":1110,"config":1111},"Demo anfordern",{"href":1112,"dataGaName":1113,"dataGaLocation":1103},"/de-de/sales/?contact-topic=request-demo","sales",{"text":1115,"config":1116},"Anmelden",{"href":1117,"dataGaName":1118,"dataGaLocation":1103},"https://gitlab.com/users/sign_in/","sign in",[1120,1149,1251,1256,1370,1426],{"text":1121,"config":1122,"menu":1124},"Plattform",{"dataNavLevelOne":1123},"platform",{"type":1125,"columns":1126},"cards",[1127,1133,1141],{"title":1121,"description":1128,"link":1129},"Die intelligente Orchestrierungsplattform für DevSecOps",{"text":1130,"config":1131},"Die Plattform erkunden",{"href":1132,"dataGaName":1123,"dataGaLocation":1103},"/de-de/platform/",{"title":1134,"description":1135,"link":1136},"GitLab Duo Agent Platform","Agentische KI für den gesamten Software-Lebenszyklus",{"text":1137,"config":1138},"Lerne GitLab Duo kennen",{"href":1139,"dataGaName":1140,"dataGaLocation":1103},"/de-de/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1142,"description":1143,"link":1144},"Warum GitLab?","Erfahre, warum sich Unternehmen für GitLab entscheiden",{"text":1145,"config":1146},"Mehr erfahren",{"href":1147,"dataGaName":1148,"dataGaLocation":1103},"/de-de/why-gitlab/","why gitlab",{"text":1150,"left":1087,"config":1151,"menu":1153},"Produkt",{"dataNavLevelOne":1152},"solutions",{"type":1154,"link":1155,"columns":1159,"feature":1230},"lists",{"text":1156,"config":1157},"Alle Lösungen anzeigen",{"href":1158,"dataGaName":1152,"dataGaLocation":1103},"/de-de/solutions/",[1160,1185,1208],{"title":1161,"description":1162,"link":1163,"items":1168},"Automatisierung","CI/CD und Automatisierung zur Beschleunigung der Bereitstellung",{"config":1164},{"icon":1165,"href":1166,"dataGaName":1167,"dataGaLocation":1103},"AutomatedCodeAlt","/de-de/solutions/delivery-automation/","automated software delivery",[1169,1173,1176,1181],{"text":1170,"config":1171},"CI/CD",{"href":1172,"dataGaLocation":1103,"dataGaName":1170},"/de-de/solutions/continuous-integration/",{"text":1134,"config":1174},{"href":1139,"dataGaLocation":1103,"dataGaName":1175},"gitlab duo agent platform - product menu",{"text":1177,"config":1178},"Quellcodeverwaltung",{"href":1179,"dataGaLocation":1103,"dataGaName":1180},"/de-de/solutions/source-code-management/","Source Code Management",{"text":1182,"config":1183},"Automatische Softwarebereitstellung",{"href":1166,"dataGaLocation":1103,"dataGaName":1184},"Automated software delivery",{"title":1186,"description":1187,"link":1188,"items":1193},"Sicherheit","Entwickle Code schneller ohne Abstriche bei der Sicherheit",{"config":1189},{"href":1190,"dataGaName":1191,"dataGaLocation":1103,"icon":1192},"/de-de/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1194,1198,1203],{"text":1195,"config":1196},"Anwendungssicherheitstests",{"href":1190,"dataGaName":1197,"dataGaLocation":1103},"Application security testing",{"text":1199,"config":1200},"Schutz der Software-Lieferkette",{"href":1201,"dataGaLocation":1103,"dataGaName":1202},"/de-de/solutions/supply-chain/","Software supply chain security",{"text":1204,"config":1205},"Software-Compliance",{"href":1206,"dataGaName":1207,"dataGaLocation":1103},"/de-de/solutions/software-compliance/","software compliance",{"title":1209,"link":1210,"items":1215},"Messung",{"config":1211},{"icon":1212,"href":1213,"dataGaName":1214,"dataGaLocation":1103},"DigitalTransformation","/de-de/solutions/visibility-measurement/","visibility and measurement",[1216,1220,1225],{"text":1217,"config":1218},"Sichtbarkeit und Messung",{"href":1213,"dataGaLocation":1103,"dataGaName":1219},"Visibility and Measurement",{"text":1221,"config":1222},"Wertstrommanagement",{"href":1223,"dataGaLocation":1103,"dataGaName":1224},"/de-de/solutions/value-stream-management/","Value Stream Management",{"text":1226,"config":1227},"Analysen und Einblicke",{"href":1228,"dataGaLocation":1103,"dataGaName":1229},"/de-de/solutions/analytics-and-insights/","Analytics and insights",{"title":1231,"type":1154,"items":1232},"GitLab für",[1233,1239,1245],{"text":1234,"config":1235},"Enterprise",{"icon":1236,"href":1237,"dataGaLocation":1103,"dataGaName":1238},"Building","/de-de/enterprise/","enterprise",{"text":1240,"config":1241},"Kleinunternehmen",{"icon":1242,"href":1243,"dataGaLocation":1103,"dataGaName":1244},"Work","/de-de/small-business/","small business",{"text":1246,"config":1247},"Öffentlicher Sektor",{"icon":1248,"href":1249,"dataGaLocation":1103,"dataGaName":1250},"Organization","/de-de/solutions/public-sector/","public sector",{"text":1252,"config":1253},"Preise",{"href":1254,"dataGaName":1255,"dataGaLocation":1103,"dataNavLevelOne":1255},"/de-de/pricing/","pricing",{"text":1257,"config":1258,"menu":1260},"Ressourcen",{"dataNavLevelOne":1259},"resources",{"type":1154,"link":1261,"columns":1265,"feature":1359},{"text":1262,"config":1263},"Alle Ressourcen anzeigen",{"href":1264,"dataGaName":1259,"dataGaLocation":1103},"/de-de/resources/",[1266,1299,1326],{"title":1267,"items":1268},"Erste Schritte",[1269,1274,1279,1284,1289,1294],{"text":1270,"config":1271},"Installieren",{"href":1272,"dataGaName":1273,"dataGaLocation":1103},"/de-de/install/","install",{"text":1275,"config":1276},"Kurzanleitungen",{"href":1277,"dataGaName":1278,"dataGaLocation":1103},"/de-de/get-started/","quick setup checklists",{"text":1280,"config":1281},"Lernen",{"href":1282,"dataGaLocation":1103,"dataGaName":1283},"https://university.gitlab.com/","learn",{"text":1285,"config":1286},"Produktdokumentation",{"href":1287,"dataGaName":1288,"dataGaLocation":1103},"https://docs.gitlab.com/","product documentation",{"text":1290,"config":1291},"Best-Practice-Videos",{"href":1292,"dataGaName":1293,"dataGaLocation":1103},"/de-de/getting-started-videos/","best practice videos",{"text":1295,"config":1296},"Integrationen",{"href":1297,"dataGaName":1298,"dataGaLocation":1103},"/de-de/integrations/","integrations",{"title":1300,"items":1301},"Entdecken",[1302,1307,1312,1317,1321],{"text":1303,"config":1304},"Kundenerfolge",{"href":1305,"dataGaName":1306,"dataGaLocation":1103},"/de-de/customers/","customer success stories",{"text":1308,"config":1309},"Blog",{"href":1310,"dataGaName":1311,"dataGaLocation":1103},"/de-de/blog/","blog",{"text":1313,"config":1314},"Demo-Hub",{"href":1315,"dataGaName":1316,"dataGaLocation":1103},"/de-de/demo-hub/","demo hub",{"text":1318,"config":1319},"The Source",{"href":1320,"dataGaName":1311,"dataGaLocation":1103},"/de-de/the-source/",{"text":1322,"config":1323},"Remote",{"href":1324,"dataGaName":1325,"dataGaLocation":1103},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1327,"items":1328},"Vernetzen",[1329,1334,1339,1344,1349,1354],{"text":1330,"config":1331},"GitLab-Services",{"href":1332,"dataGaName":1333,"dataGaLocation":1103},"/de-de/services/","services",{"text":1335,"config":1336},"Beitragen",{"href":1337,"dataGaName":1338,"dataGaLocation":1103},"https://contributors.gitlab.com","contribute",{"text":1340,"config":1341},"Community",{"href":1342,"dataGaName":1343,"dataGaLocation":1103},"/community/","community",{"text":1345,"config":1346},"Forum",{"href":1347,"dataGaName":1348,"dataGaLocation":1103},"https://forum.gitlab.com/","forum",{"text":1350,"config":1351},"Veranstaltungen",{"href":1352,"dataGaName":1353,"dataGaLocation":1103},"/events/","events",{"text":1355,"config":1356},"Partner",{"href":1357,"dataGaName":1358,"dataGaLocation":1103},"/de-de/partners/","partners",{"config":1360,"title":1363,"text":1364,"link":1365},{"background":1361,"textColor":1362},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","Neues bei GitLab","Über die neuesten Funktionen und Verbesserungen auf dem Laufenden bleiben.",{"text":1366,"config":1367},"Aktuelle Nachrichten",{"href":1368,"dataGaName":1369,"dataGaLocation":1103},"/de-de/whats-new/","whats new",{"text":1371,"config":1372,"menu":1374},"Unternehmen",{"dataNavLevelOne":1373},"company",{"type":1154,"columns":1375},[1376],{"items":1377},[1378,1383,1389,1391,1396,1401,1406,1411,1416,1421],{"text":1379,"config":1380},"Über",{"href":1381,"dataGaName":1382,"dataGaLocation":1103},"/de-de/company/","about",{"text":1384,"config":1385,"footerGa":1388},"Karriere",{"href":1386,"dataGaName":1387,"dataGaLocation":1103},"/jobs/","jobs",{"dataGaName":1387},{"text":1350,"config":1390},{"href":1352,"dataGaName":1353,"dataGaLocation":1103},{"text":1392,"config":1393},"Geschäftsführung",{"href":1394,"dataGaName":1395,"dataGaLocation":1103},"/company/team/e-group/","leadership",{"text":1397,"config":1398},"Handbuch",{"href":1399,"dataGaName":1400,"dataGaLocation":1103},"https://handbook.gitlab.com/","handbook",{"text":1402,"config":1403},"Investor Relations",{"href":1404,"dataGaName":1405,"dataGaLocation":1103},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1407,"config":1408},"Trust Center",{"href":1409,"dataGaName":1410,"dataGaLocation":1103},"/de-de/security/","trust center",{"text":1412,"config":1413},"AI Transparency Center",{"href":1414,"dataGaName":1415,"dataGaLocation":1103},"/de-de/ai-transparency-center/","ai transparency center",{"text":1417,"config":1418},"Newsletter",{"href":1419,"dataGaName":1420,"dataGaLocation":1103},"/company/contact/#contact-forms","newsletter",{"text":1422,"config":1423},"Presse",{"href":1424,"dataGaName":1425,"dataGaLocation":1103},"/press/","press",{"text":1427,"config":1428,"menu":1429},"Kontakt",{"dataNavLevelOne":1373},{"type":1154,"columns":1430},[1431],{"items":1432},[1433,1438,1443],{"text":1434,"config":1435},"Vertrieb kontaktieren",{"href":1436,"dataGaName":1437,"dataGaLocation":1103},"/de-de/sales/","talk to sales",{"text":1439,"config":1440},"Support-Portal",{"href":1441,"dataGaName":1442,"dataGaLocation":1103},"https://support.gitlab.com/hc/en-us","support portal",{"text":1444,"config":1445},"Kundenportal",{"href":1446,"dataGaName":1447,"dataGaLocation":1103},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1449,"login":1450,"suggestions":1457},"Schließen",{"text":1451,"link":1452},"Um Repositorys und Projekte zu durchsuchen, melde dich an bei",{"text":1453,"config":1454},"gitlab.com",{"href":1117,"dataGaName":1455,"dataGaLocation":1456},"search login","search",{"text":1458,"default":1459},"Vorschläge",[1460,1462,1467,1469,1474,1479],{"text":1134,"config":1461},{"href":1139,"dataGaName":1134,"dataGaLocation":1456},{"text":1463,"config":1464},"Codevorschläge (KI)",{"href":1465,"dataGaName":1466,"dataGaLocation":1456},"/de-de/solutions/code-suggestions/","Code Suggestions (AI)",{"text":1170,"config":1468},{"href":1172,"dataGaName":1170,"dataGaLocation":1456},{"text":1470,"config":1471},"GitLab auf AWS",{"href":1472,"dataGaName":1473,"dataGaLocation":1456},"/de-de/partners/technology-partners/aws/","GitLab on AWS",{"text":1475,"config":1476},"GitLab auf Google Cloud",{"href":1477,"dataGaName":1478,"dataGaLocation":1456},"/de-de/partners/technology-partners/google-cloud-platform/","GitLab on Google Cloud",{"text":1142,"config":1480},{"href":1147,"dataGaName":1481,"dataGaLocation":1456},"Why GitLab?",{"freeTrial":1483,"mobileIcon":1488,"desktopIcon":1493,"secondaryButton":1496},{"text":1484,"config":1485},"Kostenlos testen",{"href":1486,"dataGaName":1108,"dataGaLocation":1487},"https://gitlab.com/-/trials/new/","nav",{"altText":1489,"config":1490},"GitLab-Symbol",{"src":1491,"dataGaName":1492,"dataGaLocation":1487},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1489,"config":1494},{"src":1495,"dataGaName":1492,"dataGaLocation":1487},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1267,"config":1497},{"href":1498,"dataGaName":1499,"dataGaLocation":1487},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/de-de/get-started/","get started",{"freeTrial":1501,"mobileIcon":1505,"desktopIcon":1507},{"text":1502,"config":1503},"Mehr über GitLab Duo erfahren",{"href":1139,"dataGaName":1504,"dataGaLocation":1487},"gitlab duo",{"altText":1489,"config":1506},{"src":1491,"dataGaName":1492,"dataGaLocation":1487},{"altText":1489,"config":1508},{"src":1495,"dataGaName":1492,"dataGaLocation":1487},{"button":1510,"mobileIcon":1515,"desktopIcon":1517},{"text":1511,"config":1512},"/Option",{"href":1513,"dataGaName":1514,"dataGaLocation":1487},"#contact","switch",{"altText":1489,"config":1516},{"src":1491,"dataGaName":1492,"dataGaLocation":1487},{"altText":1489,"config":1518},{"src":1519,"dataGaName":1492,"dataGaLocation":1487},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1521,"mobileIcon":1526,"desktopIcon":1528},{"text":1522,"config":1523},"Zurück zur Preisübersicht",{"href":1254,"dataGaName":1524,"dataGaLocation":1487,"icon":1525},"back to pricing","GoBack",{"altText":1489,"config":1527},{"src":1491,"dataGaName":1492,"dataGaLocation":1487},{"altText":1489,"config":1529},{"src":1495,"dataGaName":1492,"dataGaLocation":1487},{"title":1531,"button":1532,"config":1536},"GitLab Orbit ist da: die Kontextebene für KI-Agenten",{"text":1145,"config":1533},{"href":1534,"dataGaName":1535,"dataGaLocation":1103},"/de-de/gitlab-orbit/","orbit",{"layout":1537,"disabled":1084},"release",{"data":1539},{"text":1540,"source":1541,"edit":1547,"contribute":1552,"config":1557,"items":1562,"minimal":1768},"Git ist eine Marke von Software Freedom Conservancy und unsere Verwendung von „GitLab“ erfolgt unter Lizenz.",{"text":1542,"config":1543},"Quelltext der Seite anzeigen",{"href":1544,"dataGaName":1545,"dataGaLocation":1546},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1548,"config":1549},"Diese Seite bearbeiten",{"href":1550,"dataGaName":1551,"dataGaLocation":1546},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1553,"config":1554},"Beteilige dich",{"href":1555,"dataGaName":1556,"dataGaLocation":1546},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1558,"facebook":1559,"youtube":1560,"linkedin":1561},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1563,1608,1661,1703,1735],{"title":1252,"links":1564,"subMenu":1579},[1565,1569,1574],{"text":1566,"config":1567},"Tarife anzeigen",{"href":1254,"dataGaName":1568,"dataGaLocation":1546},"view plans",{"text":1570,"config":1571},"Vorteile von Premium",{"href":1572,"dataGaName":1573,"dataGaLocation":1546},"/de-de/pricing/premium/","why premium",{"text":1575,"config":1576},"Vorteile von Ultimate",{"href":1577,"dataGaName":1578,"dataGaLocation":1546},"/de-de/pricing/ultimate/","why ultimate",[1580],{"title":1427,"links":1581},[1582,1584,1586,1588,1593,1598,1603],{"text":1434,"config":1583},{"href":1436,"dataGaName":1113,"dataGaLocation":1546},{"text":1439,"config":1585},{"href":1441,"dataGaName":1442,"dataGaLocation":1546},{"text":1444,"config":1587},{"href":1446,"dataGaName":1447,"dataGaLocation":1546},{"text":1589,"config":1590},"Status",{"href":1591,"dataGaName":1592,"dataGaLocation":1546},"https://status.gitlab.com/","status",{"text":1594,"config":1595},"Nutzungsbedingungen",{"href":1596,"dataGaName":1597,"dataGaLocation":1546},"/terms/","terms of use",{"text":1599,"config":1600},"Datenschutzerklärung",{"href":1601,"dataGaName":1602,"dataGaLocation":1546},"/de-de/privacy/","privacy statement",{"text":1604,"config":1605},"Cookie-Einstellungen",{"dataGaName":1606,"dataGaLocation":1546,"id":1607,"isOneTrustButton":1087},"cookie preferences","ot-sdk-btn",{"title":1150,"links":1609,"subMenu":1618},[1610,1614],{"text":1611,"config":1612},"DevSecOps-Plattform",{"href":1132,"dataGaName":1613,"dataGaLocation":1546},"devsecops platform",{"text":1615,"config":1616},"KI-unterstützte Entwicklung",{"href":1139,"dataGaName":1617,"dataGaLocation":1546},"ai-assisted development",[1619],{"title":1620,"links":1621},"Themen",[1622,1626,1631,1636,1641,1646,1651,1656],{"text":1170,"config":1623},{"href":1624,"dataGaName":1625,"dataGaLocation":1546},"/de-de/topics/ci-cd/","cicd",{"text":1627,"config":1628},"GitOps",{"href":1629,"dataGaName":1630,"dataGaLocation":1546},"/de-de/topics/gitops/","gitops",{"text":1632,"config":1633},"DevOps",{"href":1634,"dataGaName":1635,"dataGaLocation":1546},"/de-de/topics/devops/","devops",{"text":1637,"config":1638},"Versionskontrolle",{"href":1639,"dataGaName":1640,"dataGaLocation":1546},"/de-de/topics/version-control/","version control",{"text":1642,"config":1643},"DevSecOps",{"href":1644,"dataGaName":1645,"dataGaLocation":1546},"/de-de/topics/devsecops/","devsecops",{"text":1647,"config":1648},"Cloud-nativ",{"href":1649,"dataGaName":1650,"dataGaLocation":1546},"/de-de/topics/cloud-native/","cloud native",{"text":1652,"config":1653},"KI für das Programmieren",{"href":1654,"dataGaName":1655,"dataGaLocation":1546},"/de-de/topics/devops/ai-for-coding/","ai for coding",{"text":1657,"config":1658},"Agentische KI",{"href":1659,"dataGaName":1660,"dataGaLocation":1546},"/de-de/topics/agentic-ai/","agentic ai",{"title":1662,"links":1663},"Lösungen",[1664,1667,1669,1674,1678,1681,1684,1687,1689,1691,1693,1698],{"text":1195,"config":1665},{"href":1190,"dataGaName":1666,"dataGaLocation":1546},"Application Security Testing",{"text":1182,"config":1668},{"href":1166,"dataGaName":1167,"dataGaLocation":1546},{"text":1670,"config":1671},"Agile Entwicklung",{"href":1672,"dataGaName":1673,"dataGaLocation":1546},"/de-de/solutions/agile-delivery/","agile delivery",{"text":1675,"config":1676},"SCM",{"href":1179,"dataGaName":1677,"dataGaLocation":1546},"source code management",{"text":1170,"config":1679},{"href":1172,"dataGaName":1680,"dataGaLocation":1546},"continuous integration & delivery",{"text":1221,"config":1682},{"href":1223,"dataGaName":1683,"dataGaLocation":1546},"value stream management",{"text":1627,"config":1685},{"href":1686,"dataGaName":1630,"dataGaLocation":1546},"/de-de/solutions/gitops/",{"text":1234,"config":1688},{"href":1237,"dataGaName":1238,"dataGaLocation":1546},{"text":1240,"config":1690},{"href":1243,"dataGaName":1244,"dataGaLocation":1546},{"text":1246,"config":1692},{"href":1249,"dataGaName":1250,"dataGaLocation":1546},{"text":1694,"config":1695},"Bildungswesen",{"href":1696,"dataGaName":1697,"dataGaLocation":1546},"/de-de/solutions/education/","education",{"text":1699,"config":1700},"Finanzdienstleistungen",{"href":1701,"dataGaName":1702,"dataGaLocation":1546},"/de-de/solutions/finance/","financial services",{"title":1257,"links":1704},[1705,1707,1709,1711,1714,1716,1719,1721,1723,1725,1727,1729,1731,1733],{"text":1270,"config":1706},{"href":1272,"dataGaName":1273,"dataGaLocation":1546},{"text":1275,"config":1708},{"href":1277,"dataGaName":1278,"dataGaLocation":1546},{"text":1280,"config":1710},{"href":1282,"dataGaName":1283,"dataGaLocation":1546},{"text":1285,"config":1712},{"href":1287,"dataGaName":1713,"dataGaLocation":1546},"docs",{"text":1308,"config":1715},{"href":1310,"dataGaName":1311,"dataGaLocation":1546},{"text":1717,"config":1718},"Neuerungen",{"href":1368,"dataGaName":1369,"dataGaLocation":1546},{"text":1303,"config":1720},{"href":1305,"dataGaName":1306,"dataGaLocation":1546},{"text":1322,"config":1722},{"href":1324,"dataGaName":1325,"dataGaLocation":1546},{"text":1330,"config":1724},{"href":1332,"dataGaName":1333,"dataGaLocation":1546},{"text":1335,"config":1726},{"href":1337,"dataGaName":1338,"dataGaLocation":1546},{"text":1340,"config":1728},{"href":1342,"dataGaName":1343,"dataGaLocation":1546},{"text":1345,"config":1730},{"href":1347,"dataGaName":1348,"dataGaLocation":1546},{"text":1350,"config":1732},{"href":1352,"dataGaName":1353,"dataGaLocation":1546},{"text":1355,"config":1734},{"href":1357,"dataGaName":1358,"dataGaLocation":1546},{"title":1371,"links":1736},[1737,1739,1741,1743,1745,1747,1752,1757,1759,1761,1763],{"text":1379,"config":1738},{"href":1381,"dataGaName":1373,"dataGaLocation":1546},{"text":1384,"config":1740},{"href":1386,"dataGaName":1387,"dataGaLocation":1546},{"text":1392,"config":1742},{"href":1394,"dataGaName":1395,"dataGaLocation":1546},{"text":1397,"config":1744},{"href":1399,"dataGaName":1400,"dataGaLocation":1546},{"text":1402,"config":1746},{"href":1404,"dataGaName":1405,"dataGaLocation":1546},{"text":1748,"config":1749},"Nachhaltigkeit",{"href":1750,"dataGaName":1751,"dataGaLocation":1546},"/sustainability/","Sustainability",{"text":1753,"config":1754},"Vielfalt, Inklusion und Zugehörigkeit",{"href":1755,"dataGaName":1756,"dataGaLocation":1546},"/de-de/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1407,"config":1758},{"href":1409,"dataGaName":1410,"dataGaLocation":1546},{"text":1417,"config":1760},{"href":1419,"dataGaName":1420,"dataGaLocation":1546},{"text":1422,"config":1762},{"href":1424,"dataGaName":1425,"dataGaLocation":1546},{"text":1764,"config":1765},"Transparenzerklärung zu moderner Sklaverei",{"href":1766,"dataGaName":1767,"dataGaLocation":1546},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1769},[1770,1773,1776],{"text":1771,"config":1772},"Terms",{"href":1596,"dataGaName":1597,"dataGaLocation":1546},{"text":1774,"config":1775},"Cookies",{"dataGaName":1606,"dataGaLocation":1546,"id":1607,"isOneTrustButton":1087},{"text":1777,"config":1778},"Datenschutz",{"href":1601,"dataGaName":1602,"dataGaLocation":1546},[1780],{"id":1781,"title":7,"body":1083,"config":1782,"content":1784,"description":1083,"extension":1788,"meta":1789,"navigation":1087,"path":1790,"seo":1791,"stem":1792,"__hash__":1793},"blogAuthors/en-us/blog/authors/fernando-diaz.yml",{"template":1783},"BlogAuthor",{"name":7,"config":1785},{"headshot":1786,"ctfId":1787},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659556/Blog/Author%20Headshots/fern_diaz.png","fjdiaz","yml",{},"/en-us/blog/authors/fernando-diaz",{},"en-us/blog/authors/fernando-diaz","lxRJIOydP4_yzYZvsPcuQevP9AYAKREF7i8QmmdnOWc",[1795,1802,1810],{"title":1796,"description":1797,"heroImage":1085,"category":1079,"date":1798,"authors":1799,"slug":1801,"externalUrl":1083},"Wie GitLab Schwachstellen über Refactorings hinweg verfolgt","Das verbesserte Scope+Offset-Fingerprinting hält das Tracking stabil, wenn Kommentare, Leerzeilen oder Reformatierungen dazukommen.","2026-08-12",[1800],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1803,"description":1804,"heroImage":1085,"category":1079,"date":1805,"authors":1806,"slug":1809,"externalUrl":1083},"GitLab Secrets Manager unterstützt ESO, Terraform und API","GitLab Secrets Manager liefert Secrets sicher an Kubernetes, Terraform und externe Workflows, aus einer einzigen Quelle für die gesamte Toolchain.","2026-08-06",[1807,1808],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1811,"description":1812,"heroImage":1813,"category":1079,"date":1814,"authors":1815,"slug":1817,"externalUrl":1083},"Mit Claude und GitLab jeden Commit bis zur Produktion absichern","Claude Security findet Schwachstellen in der Coding-Session. GitLab übernimmt danach: Scans, Policy-Durchsetzung und Audit-Nachweise im Lebenszyklus.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1816],"Alisa Ho","claude-security-and-gitlab",{"header":1819,"blurb":1820,"button":1821,"secondaryButton":1826},"Beginne noch heute, schneller zu entwickeln","Entdecke, was dein Team mit der intelligenten Orchestrierungsplattform für DevSecOps erreichen kann.\n",{"text":1822,"config":1823},"Kostenlosen Test starten",{"href":1824,"dataGaName":1108,"dataGaLocation":1825},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/de-de/","feature",{"text":1434,"config":1827},{"href":1436,"dataGaName":1113,"dataGaLocation":1825},{"promotions":1829},[1830,1844,1856,1867],{"id":1831,"categories":1832,"header":1834,"text":1835,"button":1836,"image":1841},"ai-modernization",[1833],"ai","Hält KI, was uns versprochen wurde?","Das Quiz dauert maximal 5 Minuten.",{"text":1837,"config":1838},"Ermittle deinen KI-Reifegrad",{"href":1839,"dataGaName":1840,"dataGaLocation":1311},"/de-de/assessments/ai-modernization-assessment/","modernization assessment",{"config":1842},{"src":1843},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1845,"categories":1846,"header":1848,"text":1835,"button":1849,"image":1853},"devops-modernization",[1847,1645],"product","Verwaltest du Tool-Chaos oder stellst du Innovationen bereit?",{"text":1850,"config":1851},"Ermittle deinen DevOps-Reifegrad",{"href":1852,"dataGaName":1840,"dataGaLocation":1311},"/de-de/assessments/devops-modernization-assessment/",{"config":1854},{"src":1855},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1857,"categories":1858,"header":1859,"text":1835,"button":1860,"image":1864},"security-modernization",[1079],"Tauschst du Schnelligkeit gegen Sicherheit ein?",{"text":1861,"config":1862},"Ermittle deinen Sicherheitsreifegrad",{"href":1863,"dataGaName":1840,"dataGaLocation":1311},"/de-de/assessments/security-modernization-assessment/",{"config":1865},{"src":1866},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1868,"paths":1869,"header":1872,"text":1873,"button":1874,"image":1879},"github-azure-migration",[1870,1871],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Ist dein Team bereit für den Umzug von GitHub nach Azure?","GitHub stellt bereits auf Azure um. Finde heraus, was das für dich bedeutet.",{"text":1875,"config":1876},"Erfahre, wie GitLab im Vergleich zu GitHub abschneidet",{"href":1877,"dataGaName":1878,"dataGaLocation":1311},"/de-de/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1880},{"src":1855},1786803738096]